EIP-2026-102640

PRE-CVE

Linux - Use-After-Free via race Between modify_ldt() and #BR Exception

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-102640. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit demonstrates a use-after-free vulnerability in the Linux kernel's MPX bounds violation handling, specifically in the `insn_get_seg_base` function. The PoC triggers a race condition by rapidly modifying the LDT while generating MPX bounds violations, leading to a KASAN-reported use-after-free.

Description

Linux - Use-After-Free via race Between modify_ldt() and #BR Exception

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · cdoslinux
https://www.exploit-db.com/exploits/47015

This exploit demonstrates a use-after-free vulnerability in the Linux kernel's MPX bounds violation handling, specifically in the `insn_get_seg_base` function. The PoC triggers a race condition by rapidly modifying the LDT while generating MPX bounds violations, leading to a KASAN-reported use-after-free.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel 4.15 and later (up to at least 5.2-rc2)
No auth needed
Prerequisites: MPX (Memory Protection Extensions) support in CPU · Linux kernel with MPX enabled · 32-bit process execution environment
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026